nixos-rebuild: Ask for admin privileges

[AMDphreak]

Issue description

nixos-rebuild should ask for elevated privileges.

citing this: VSCode does not build (declarative installation) #55790

Additionally, it appears that you've used nixos-rebuild without sudo which is probably why you got the permission error.

[matthewbauer]

I think only nixos-rebuild switch needs root priveleges.

[vcunat]

Right, I commonly build my system without root privileges with nixos-rebuild build, and then I use boot or switch with sudo. Adding --upgrade would also require sudo.

[AMDphreak]

I think only nixos-rebuild switch needs root priveleges.

Good catch. I wasn't aware. I've been doing all commands as root.

[aaronjanse]

Prompting the user for the sudo password at the beginning can save time. Think of how installing Windows would (at least used) take a while due to blocking dialogs showing up while the user is off doing another task (since the install takes a while).

On the other hand, the user may want to run as superuser only what's necessary, for security reasons. I don't know if this is a legitimate concern once the entire the nixos-rebuild process is taken into account.

[aaronjanse]

Relevant: https://discourse.nixos.org/t/error-on-nixos-rebuild-with-an-empty-configuration-file/1555

[AMDphreak]

@aaronjanse It does so much more. Requesting root is an essential user experience change. Linux land is filled with unhelpful error messages. This habit has to be fixed.

[domenkozar]

Relevant: https://github.com/hercules-ci/ghcide-nix/issues/14#issuecomment-542912692

[domenkozar]

Seems like the consensus is to improve the error message based on #57333 (comment)

[stale]

Thank you for your contributions.
This has been automatically marked as stale because it has had no activity for 180 days.
If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.
Here are suggestions that might help resolve this more quickly:

1. Search for maintainers and people that previously touched the
   related code and @ mention them in a comment.
2. Ask on the NixOS Discourse. 3. Ask on the #nixos channel on
   irc.freenode.net.

[bobvanderlinden]

It seems there is a conscious decision to not automatically run sudo, but make it explicit.

It is possible to run sudo automatically when using --use-remote-sudo:

$ nixos-rebuild --use-remote-sudo boot

Should the user be informed about this option when they run into permission errors?

[con-f-use]

The problem with that nixos-rebuild --use-remote-sudo is broken (see #118655)

[rgri]

Curious if there are any favourite workarounds people are using for this. I suppose I will just end up using a deployment tool, but my scale is reallly small, so if I could deploy using just nixos-rebuild I'd be very happy with that.

[loic-roux-404]

bump

It could be nice to provide root password to let nix make the escalation using another method than sudo with an user utilising a kind of wheel group